21.3 Million PrestaShop Customer Details for Sale on Dark Web

According to multiple reports, a threat actor is attempting to sell the stolen data of over 21.3 million PrestaShop users on a dark web forum. Potential buyers can already view a subset of the data for free before deciding whether to bid on the entire database.

The data obtained in the breach purportedly contains personally identifiable information (PII), such as full names, company names, addresses, phone numbers, VAT numbers, DNIs, and customer IDs in SQL schema format, as per SOCrader. The sellers themselves attribute the hack to another organization, and it’s not yet clear where exactly it came from.

Brinztech researchers previously reported on threat actors obtaining unauthorized access to 126 PrestaShop stores and selling this information online. However, it has not been confirmed whether the newly discovered data that’s up for sale originated from the same breach.

PrestaShop has also not commented on the matter thus far. However, the popular open-source e-commerce platform has been involved in numerous high-profile cybersecurity events in recent years. Some of these even involved highly sensitive payment details related to credit cards or digital gateways like PensoPay, Datatrans, PayPal, or Tap, risking widespread financial fraud.

Should this latest data fall into the wrong hands, it could be used by threat actors to launch unauthorized takeovers of online stores hosted on PrestaShop, steal funds from users, and even commit high-level fraud.

As Brinztech researchers put it, it’s “not a single company breach” but a “compromise of the foundational software used by thousands of independent online retailers.”

Store owners using PrestaShop are advised to immediately audit their installations for any signs of suspicious activity, apply the latest security patches, and force password resets for all their customers. Customers who have used stores hosted on PrestaShop should closely monitor their financial accounts for any unauthorized transactions.

It has not been a good month for online retail. Earlier in August, hackers claimed to have breached PayPal and to be in possession of 15.8 million user records, also up for sale. The ShinyHunters cybergang also continues to target multiple companies with sophisticated social engineering attacks.